BYOD is a reality for most businesses. Intune App Protection Policies let you protect company data on personal iPhones and Android devices without enrolling the device or touching personal content.
Key takeaways
- 1Data can't be cut-and-paste from managed Outlook into personal apps
- 2Company files downloaded in managed apps can't be opened in unmanaged personal apps
- 3A PIN or biometric is required to open managed apps
- 4Company data can be remotely wiped from managed apps without touching personal photos, contacts, or messages
- 5Screen capture can be blocked within managed apps on Android
Bring-Your-Own-Device (BYOD) policies are now the norm rather than the exception. Staff use personal iPhones and Android devices to check company email, access Teams, and view SharePoint documents. From a security perspective, this creates real risk — company data on unmanaged, unknown devices. Intune App Protection Policies (APP) solve this without requiring full device enrolment.
How App Protection Policies work
App Protection Policies apply controls to specific managed apps (Outlook, Teams, OneDrive, SharePoint) without affecting the personal apps and data on the same device. The managed apps operate within a protected container:
- Data can't be cut-and-paste from managed Outlook into personal apps
- Company files downloaded in managed apps can't be opened in unmanaged personal apps
- A PIN or biometric is required to open managed apps
- Company data can be remotely wiped from managed apps without touching personal photos, contacts, or messages
- Screen capture can be blocked within managed apps on Android
The privacy win for employees
One of the common objections to mobile device management is employee privacy concern — nobody wants IT to have access to their personal photos or location. App Protection Policies remove this concern entirely: Intune never enrolls the personal device, never sees personal data, and only manages the specific Microsoft 365 apps within the container.
How Optimyze deploys APP
For every managed IT client with BYOD mobile users, Optimyze configures App Protection Policies for iOS and Android. We require the latest app versions, enforce a PIN or biometric, block data sharing with unmanaged apps, and configure remote wipe capability. Users install the Intune Company Portal app (which enables the policy) but their device is never enrolled in full MDM.
